Protocol Reference
Documentation, flow diagrams, and security considerations for each protocol family.
OAuth 2.0
RFC 6749SpecThe industry-standard authorization framework for delegated access. Enables applications to obtain limited access to user accounts without exposing credentials.
Available Flows
OpenID Connect
OpenID Connect Core 1.0SpecAn identity layer built on top of OAuth 2.0. Adds authentication to authorization, enabling clients to verify user identity and obtain basic profile information.
Available Flows
OID4VCI
OpenID4VCI 1.0SpecOpenID for Verifiable Credential Issuance. Demonstrates credential offers, pre-authorized code token exchange, nonce-bound proof validation, and multi-format VC issuance (mso_mdoc by default, plus dc+sd-jwt, jwt_vc_json, jwt_vc_json-ld, ldp_vc).
Available Flows
OID4VP
OpenID4VP 1.0SpecOpenID for Verifiable Presentations. Shows DCQL request contracts, request object validation, direct_post/direct_post.jwt responses, and verifier policy decisions.
SAML 2.0
SAML 2.0 CoreSpecXML-based standard for exchanging authentication and authorization data between identity providers and service providers. Enables enterprise single sign-on.
Available Flows
SPIFFE/SPIRE
SPIFFE SpecificationsSpecSecure Production Identity Framework for Everyone. Provides cryptographic workload identity for zero-trust architectures via X.509 and JWT SVIDs.
Available Flows
System for Cross-domain Identity Management (SCIM). Standards-based protocol for automating user provisioning and lifecycle management between identity providers and service providers.
Available Flows
Shared Signals (SSF)
SSF 1.0, CAEP 1.0, RISC 1.0, RFC 8417SpecOpenID Shared Signals Framework for real-time security event sharing. Enables continuous access evaluation (CAEP) and risk incident coordination (RISC) between identity providers and relying parties.
Available Flows
Agentic Registration
auth.md, RFC 7523, RFC 8628SpecSelf-registration and credential issuance for autonomous agents. An agent registers over a back channel, receives a signed identity assertion, and exchanges it for an access token. A claim ceremony modelled on the device authorization grant later binds the agent to a person and widens its scope.
Model Context Protocol
MCP 2026-07-28, SEP-2127SpecA remote MCP server over the Streamable HTTP transport. Revision 2026-07-28 is stateless: there is no initialize handshake and no session header, so every request carries its own protocol version and client identity and any instance can answer it. Read-only tools expose the protocol catalog, flow definitions, and JWT decoding to agents that are not running in a browser.